PT-2023-33051 · Unknown · Basti Connect

Published 2023-08-24 · Updated 2023-08-24

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Basti connect (affected versions not specified)

Description The Minimal IAM Policy for basti connect lacks the ssm:SessionDocumentAccessCheck condition, allowing users to obtain a shell session on the bastion, beyond the intended access for port forwarding. This issue affects the basti connect tool, designed to securely connect to RDS/Aurora/Elasticache/EC2 instances using a bastion instance with AWS Session Manager port forwarding capability. The estimated number of potentially affected devices worldwide is not available.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-Q4PP-J36H-3GQG

Affected Products

Basti Connect

References · 4

• https://osv.dev/vulnerability/GHSA-q4pp-j36h-3gqg · Vendor Advisory
• https://github.com/BohdanPetryshyn/basti/commit/f6f218e7cd450e29aeb616960b7abbe8dfc87796 · Note
• https://github.com/BohdanPetryshyn/basti/security/advisories/GHSA-q4pp-j36h-3gqg · Note
• https://github.com/BohdanPetryshyn/basti · Note